Yesterday someone asked me how to periodically save the running config using an EEM (Embedded Event Manager) applet. I’d never used EEM before (I’m terrified of code), but I decided to do some research to see how it could be done. It was surprisingly easy. Here’s what EEM is according to Cisco:

Embedded Event Manager (EEM) is a powerful and flexible subsystem in Cisco IOS that provides real-time network event detection and onboard automation. Using EEM, customers can adapt the behavior of their network devices to align with their business needs.

This applet was needed so the work done by his helpdesk team would be written to the config. They are given very limited access and are unable to execute the “wr” command. The first thing I gave him was this:

event manager applet WR_CONFIG
event syslog pattern ".*%SYS-5-CONFIG_I.*"
action 1.1 cli command "enable"
action 1.2 cli command "wr"
action 1.3 syslog msg "Config changed by user, new config has been written"

I told him this could do what he asked, but I wouldn’t recommend using it (I recommended a Perl script that runs daily to backup and save configs). It will save any changes once any user exits config mode. This could obviously be a bad thing if the wrong commands were entered. This applet reacts to the pattern matching “%SYS-5-CONFIG_I”. When it sees this pattern it will run through the commands I have given, first it will enable, then it writes the config. After the config is successfully written it sends a message to the console and syslog. Here it is in action:

EDGE(config)#event manager applet WR_CONFIG
EDGE(config-applet)#event syslog pattern ".*%SYS-5-CONFIG_I.*"
EDGE(config-applet)#action 1.1 cli command "enable"
EDGE(config-applet)#action 1.2 cli command "wr"
EDGE(config-applet)#action 1.3 syslog msg "Config changed by user, new config has been written"
Jan  5 15:03:47.085: %SYS-5-CONFIG_I: Configured from console by colby on vty0
Jan  5 15:03:47.905: %HA_EM-6-LOG: WR_CONFIG: Config changed by user, new config has been written

So it worked, but I wasn’t crazy about how it worked. So I decided to figure out how to do a periodic save based on time instead of changes. This was also surprisingly easy:

event manager applet WR_Conf
 event timer cron name WR_Conf cron-entry "* 0 * * *"
 action 1.0 cli command "enable"
 action 1.1 cli command "wr"
 action 1.2 syslog msg "Config has been saved by EEM script"

This applet is basically using cron, which is ‘time-based job scheduler’ typically used on *nix. It will enable and save the config every day at 12am, when the write is complete it sends a message.

So that’s my first exposure to EEM. I have a feeling this will be the first of many posts on EEM, I really like it. Hope this was helpful.


Colby Glass has been in IT since 2002. He is currently a network engineer with a Cisco Gold partner and holds the CCNP R/S, CCNP DC, CCDP, CCIP, JNCIA-ER and ITILv3: Foundations certifications.

More Posts